Transparent pricing.
Governed AI workforce.
Pick the plan that fits your investigation volume. Every plan includes the full Helix governance backbone — kill-switch, audit log, and HITL escalation — regardless of tier.
Security Alert Triage platform
Autonomous triage of your security alert queue. Priced by investigation volume — pay for what Helix triages, not for seats.
Sentinel Starter
For growing security teams that need governed triage at a predictable price.
- Up to 500 investigations per month
- $5 per investigation overage
- Microsoft Defender connector
- 1 connector source
- L1 autonomy (analyze-only)
- Email escalation
- 90-day audit log retention
- Standard support (next business day)
Sentinel Pro
For mature security programs that need multi-connector coverage and gated remediation.
- Up to 2,000 investigations per month
- $5 per investigation overage
- Up to 8 connectors, enabled during onboarding
- L1 and L2 autonomy (gated remediation)
- PSA / ticketing integration
- HITL approval queue
- 1-year audit log retention
- Priority support (4-hour SLA)
- Quarterly posture review
Sentinel Enterprise
Unlimited investigations, dedicated SLA, and custom playbook authoring for large teams.
- Unlimited investigations
- Up to 8 connectors + custom, enabled during onboarding
- L1, L2, and L3 autonomy
- Custom playbook authoring
- Dedicated Customer Success Manager
- Unlimited audit log retention
- 1-hour SLA, 24/7 support
- On-site security posture workshop
- Custom SIEM / SOAR integration
Sentinel plan features
| Feature | Starter | Pro | Enterprise |
|---|---|---|---|
| Investigations per month | 500 | 2,000 | Unlimited |
| Overage cost | $5/each | $5/each | Negotiated |
| Connector sources | 1 | Up to 8 (onboarding) | Up to 8 + custom (onboarding) |
| Autonomy levels | L1 only | L1, L2 | L1, L2, L3 |
| HITL approval queue | |||
| PSA / ticketing integration | |||
| Audit log retention | 90 days | 1 year | Unlimited |
| Custom playbooks | |||
| Dedicated CSM | |||
| Support SLA | Next day | 4 hours | 1 hour, 24/7 |
AI role SKUs
Add individual AI roles to your existing security stack, or buy the Complete bundle for all current and future Helix roles.
Analyst
A single AI analyst role. Best for teams that need triage coverage without full-platform licensing.
- Security Alert Triage
Responder
Adds gated remediation and HITL approval to the Analyst role.
- Security Alert Triage
- Gated Remediation
Suite
Five AI roles covering the full SOC analyst workflow — triage, response, posture, and reporting.
- Security Alert Triage
- Gated Remediation
- Posture Monitor
- Incident Summarizer
- Weekly Posture Report
Complete
All current and future Helix AI roles, unlimited seats. The full governed AI workforce.
- All current Helix roles
- All future Helix roles (included as shipped)
- Unlimited seats
- Custom role authoring
Workforce SKUs can be used standalone or combined with a Sentinel plan. Contact sales for bundle discounts.
Frequently asked questions
- What counts as an investigation?
- An investigation is one alert processed end-to-end by the Helix triage playbook — ingest, classify, filter, enrich, and either resolve (false positive) or escalate (true positive / unknown). Suppressed duplicates within a 5-minute window count as one investigation.
- Can I change plans mid-month?
- Yes. Upgrades take effect immediately and are prorated. Downgrades take effect at the next billing cycle.
- What connectors are supported?
- Helix has connector integrations built for Microsoft Defender (M365), SentinelOne, NinjaOne RMM, Adlumin MDR, Trustifi Email Security, Atera RMM, BlackPoint MDR, and Google Workspace. Not all 8 are live in production yet — connectors are enabled per tenant during onboarding, and we will confirm which are ready for your stack before you commit. Starter includes one connector.
- Is there a free trial?
- There is no self-serve free trial today. Book a 30-minute working session and we will run Helix against a redacted sample of your real alerts at no charge. You get a written posture report regardless of whether you buy.
- How is billing handled?
- Self-serve Stripe billing is not live yet — every plan above routes to booking a call, and we set up billing and connectors together during onboarding. Once live, Stripe will charge monthly in advance with overage investigations billed at the end of each cycle. Enterprise customers are invoiced on a negotiated schedule.
- Is Helix EU AI Act Article 14 compliant?
- Helix is designed to map to the five oversight abilities in Article 14 of Regulation (EU) 2024/1689. Human escalation is mandatory for all high and critical findings regardless of autonomy level. A written posture summary is available on all plans.
Not sure which plan? We will help you size it.
Book a 30-minute working session. We run Helix against a redacted sample of your real alerts and recommend the plan that fits your actual investigation volume — no pressure, no slide deck.
Book a demo